bibed[.]vip

bibed.vip was observed in a phishing campaign and taken offline as of the report date. The domain was registered on May 06, 2025 through Domain International Services Limited and uses Cloudflare’s DNS infrastructure (quentin.ns.cloudflare.com, samara.ns.cloudflare.com). It resolves to the IPv6 address 2606:4700:3031::6815:4d09, which belongs to AS13335 Cloudflare, Inc., located in the United States. No SSL certificate is presented for the host, indicating that HTTPS was not configured.

The domain appears on a single public blocklist, PhishDestroy, which has also actively blocked the host. VirusTotal analysis shows that 2 of 95 scanned engines flagged the domain as malicious, supporting the phishing classification. Scamadviser assigns a trust score of 41 out of 100, reflecting a low reputation. The site’s content, page title, and targeted brand have not been publicly disclosed, limiting further attribution.

The combination of recent registration, Cloudflare hosting, lack of TLS, and detection by multiple security vendors suggests a purpose-built phishing infrastructure. Defenders should continue to block bibed.vip at perimeter and DNS layers, monitor for any re‑registration or resurrection, and consider adding the IPv6 address to threat‑intel feeds. Additional investigation, such as retrieval of archived HTTP responses or sandbox analysis of any associated payloads, would be required to confirm the phishing vector and identify any credential‑harvesting mechanisms.